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Claims 

What is claimed is: 

1 1 . An application monitoring system, comprising: 

2 (a) at least one media module coupled to an associated network segment on which a 

3 network application is running, each media module adapted for monitoring and 

4 collecting data relating to traffic on the associated network segment 

5 corresponding to the network application, wherein each media module is tailored 

6 for network analysis; and 

7 (b) an application server module coupled to the at least one media module for 
receiving the data and analyzing the data for improving the performance of the 
network application. 

The system as recited in claim 1, wherein the application server module provides 
at least one of a user interface, provisioning, reports, alarms, statistics, and an 
SNMP agent. 

The system as recited in claim 2, wherein the user interface is accessible via an 
Internet connection. 

The system as recited in claim 1, wherein the at least one media module includes 
at least two media modules of different types. 

The system as recited in claim 1, further comprising at least one additional 
media module that monitors network traffic not related to the network 
application. 
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1 6. The system as recited in claim 1, wherein multiple media modules are coupled to 

2 a common chassis. 

1 7. The system as recited in claim 1, wherein the system is self-managed. 

1 8. The system as recited in claim 1 , wherein the system is remotely upgradeable. 

1 9. The system as recited in claim 1, wherein the application server module provides 

2 expert functions when analyzing the data. 

1 10. The system as recited in claim 1 , wherein the application server module 

2 performs a security analysis based on the data. 

1 11. The system as recited in claim 1 , wherein the application server module 

2 performs policy management functions when analyzing the data. 

1 12. The system as recited in claim 1, wherein the application server module 

2 performs accounting functions when analyzing the data. 

1 13. The system as recited in claim 1, wherein trigger scripts are used to customize 

2 the analysis of the data by the application server module. 

1 14. The system as recited in claim 1 , wherein the application server module detects, 

2 configures, manages and downloads software to the at least one media module. 

1 15. The system as recited in claim 1 > wherein the at least one media module 

2 preprocesses the data prior to receipt of the data by the application server 

3 module. 
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1 16. The system as recited in claim 1, wherein the application server module includes 

2 a user interface server for managing interactions with a user, an object repository 

3 coupled to the user interface server for storing objects, a configuration manager 

4 coupled to the user interface server for providing access to the objects, a remote 

5 network monitoring services subsystem coupled to the user interface system for 

6 providing remote access to the objects, an expert server coupled to the object 

7 repository for analyzing data received from a media module, and an 

8 administrative services subsystem coupled to the user interface server for 

9 providing administrative functions involving the objects. 



The system as recited in claim 16, wherein the application server module further 
includes at least one of a logging manager for storing logging information, a 
statistics manager for dispatching statistics, an alarm manager for dispatching 
alarms, an event manager for dispatching events, a capture manager subsystem 
for creating trace files, a session manager for managing a user session, a security 
manager for providing authorization levels to users, a registry services 
subsystem for associating an object with at least one of a user and the server 
system, a triggers manager for managing triggers, and a hardware services 
subsystem for providing communication between the server system and external 
modules. 



1 18. The system as recited in claim 1 , wherein the at least one media module includes 

2 a data collection module for collecting data from a network segment and 

3 prepending the data with descriptor information, a flow processor for classifying 

4 the collected data into a plurality of flows, a capture buffer coupled to the flow 

5 processor for filtering and buffering the collected data in accordance with the 

6 flow processor, and a main processor for processing the collected data. 
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1 19. The system as recited in claim 1 8, wherein the at least one media module 

2 performs adaptive priority data filtering, comprising: 

3 (i.) classifying the data in the network segment into multiple flows; 

4 (ii.) prioritizing the flows into high and low priority flows; 

5 (iii.) monitoring an amount of data in the high priority flows; and 

6 (iv.) reallocating resources from the low priority queue to the high priority 

7 queue if the amount of data in the high priority flows surpasses a 

8 predetermined threshold. 

1 20. The system as recited in claim 1, wherein the analysis of the data by the 

2 application server module includes creating reports, graphs and logs based on 

3 the monitored data; and outputting the reports, graphs and logs to a user. 



The system as recited in claim 1, wherein the data analysis performed by the 
application server module includes gathering performance data of the application 
during the monitoring; generating a set of metrics in real time based on the 
performance data; and measuring a performance of the application from at least 
one of a client perspective, a server perspective, and a network perspective based 
on the metrics. 



1 22. A computer program product for monitoring a network application, comprising: 

2 (a) computer code for monitoring and collecting data relating to traffic on a network 

3 segment corresponding to a network application utilizing a media module 

4 tailored for network analysis; 

5 (b) computer code for receiving the data; and 

6 (c) computer code for analyzing the data for improving the performance of the 

7 network application utilizing an application server module. 
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1 23. A method for monitoring a network application, comprising: 

2 (a) monitoring and collecting data relating to traffic on a network segment 

3 corresponding to a network application utilizing a media module tailored for 

4 network analysis; and 

5 (b) analyzing the data for improving the performance of the network application 

6 utilizing an application server module. 

1 24. The method as recited in claim 23, further comprising providing at least one of a 

2 user interface, provisioning, reports, alarms, statistics, and an SNMP agent. 

1 25. The method as recited in claim 24, wherein the user interface is accessible via an 

2 Internet connection. 

1 26. The method as recited in claim 23, further comprising simultaneously 

2 monitoring different types of data on multiple co-located network segments. 

1 27. The method as recited in claim 23, further comprising monitoring network 

2 traffic not related to the network application. 

1 28. The method as recited in claim 23, further comprising performing expert 

2 functions when analyzing the data. 

1 29. The method as recited in claim 23, further comprising performing a security 

2 analysis based on the data. 

1 30. The method as recited in claim 23, further comprising performing policy 

2 management functions when analyzing the data. 
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1 31. The method as recited in claim 23 , further comprising performing accounting 

2 functions when analyzing the data. 

1 32. The method as recited in claim 23, wherein trigger scripts are used to customize 

2 the analysis of the data. 

1 33. The method as recited in claim 23, further comprising managing interactions 

2 with a user, storing objects, providing access to the objects, providing remote 

3 access to the objects, analyzing data received from a media module, and 

4 providing administrative functions involving the objects. 

1 34. The method as recited in claim 33, further comprising storing logging 

2 information, dispatching statistics, dispatching alarms, dispatching events, 

3 creating trace files, managing a user session, providing authorization levels to 

4 users, associating an object with at least one of a user and the server system, 

5 managing triggers, and providing communication between the server method and 

6 external modules. 

1 35. The method as recited in claim 23, further comprising prepending the data 

2 collected from the network segment with descriptor information, classifying the 

3 collected data into a plurality of flows, filtering and buffering the collected data 

4 in accordance with the flow processor, and processing the collected data. 

1 36. The method as recited in claim 35, wherein the at least one media module 

2 performs adaptive priority data filtering, comprising: 

3 (i.) classifying the data in the network segment into multiple flows; 

4 (ii.) prioritizing the flows into high and low priority flows; 

5 (iii.) monitoring an amount of data in the high priority flows; and 
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6 (iv.) reallocating resources from the low priority queue to the high priority 

7 queue if the amount of data in the high priority flows surpasses a 

8 predetermined threshold. 

1 37. The method as recited in claim 23, further comprising creating reports, graphs 

2 and logs based on the monitored data; and outputting the reports, graphs and 

3 logs to a user. 

1 38. The method as recited in claim 23, wherein the data analysis includes gathering 

2 performance data of the application during the monitoring; generating a set of 

3 metrics in real time based on the performance data; and measuring a 

4 performance of the application from at least one of a client perspective, a server 

5 perspective, and a network perspective based on the metrics. 

1 39. A network monitoring system, comprising: 

2 (a) at least one media module coupled to an associated network segment on which 

3 network traffic is passing, each media module adapted for monitoring and 

4 collecting data relating to the traffic on the associated network segment, wherein 

5 each media module is tailored for network analysis; and 

6 (b) an application server module coupled to the at least one media module for 

7 receiving the data and analyzing the data for improving the performance of the 

8 network. 
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